This critical authentication bypass vulnerability in ownCloud core is actively exploited in the wild and allows unauthenticated attackers to gain unauthorized access to sensitive files.

The flaw exists because the system incorrectly processes pre-signed URLs, accepting them even when no signing key has been configured for the file owner. This allows an unauthenticated attacker to manipulate file access by targeting known usernames.

Successful exploitation of this vulnerability results in full unauthorized access to the ownCloud environment, including the ability to read, modify, or delete any file belonging to a targeted user. Given the CVSS score of 9.5, this represents a critical risk to data confidentiality, integrity, and availability. Organizations relying on ownCloud for document management face significant operational disruption and data breach risks if this flaw is not remediated.

Immediate Action: Upgrade ownCloud core to version 10.13.1 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Monitor WebDAV API access logs for anomalous requests or unauthorized attempts to access files using pre-signed URLs.

Compensating Controls: If immediate patching is not feasible, ensure all users have a valid signing key configured, although a full software update remains the only definitive remediation.

Public Exploit Available: Yes, a public proof-of-concept exists in the ambionics/owncloud-exploits GitHub repository.

Given the critical severity of this vulnerability and the confirmed reports of active exploitation, immediate action is required. Administrators must prioritize updating ownCloud core to the patched version. Failure to act leaves the environment open to complete data compromise by unauthenticated remote attackers.